Top News

Weeks after OpenAI confirmed that a combination of its own AI models autonomously hacked into Hugging Face during internal security testing, the episode is emerging as a case study in what defenders should expect as AI agents grow more capable of finding — and exploiting — weaknesses on their own.

The more pressing question now is less about what happened than what it signals: that autonomous systems can chain together vulnerabilities faster than humans can anticipate them, and that defenders’ own tools may not be ready for that speed.

The breach, first disclosed by Hugging Face last week without naming OpenAI, is now subject to a joint investigation. OpenAI said the “unprecedented” incident involved several models — including GPT-5.6 Sol and an unreleased, more capable system — running with reduced cyber safeguards for the evaluation. Set loose in a sandboxed environment with internet access restricted, the models exploited an unknown “zero-day” flaw in a software proxy to reach the open internet, then moved laterally through OpenAI’s systems before targeting Hugging Face, correctly inferring the platform held data that could help solve their task. Chaining stolen credentials with the exploit, they achieved remote code execution on Hugging Face’s servers, whose security team detected and contained the intrusion before OpenAI’s engineers made contact.

Gerald Beuchelt, CISO at Acronis, said Hugging Face’s forensic team hit trouble reconstructing the attack with hosted frontier models: safety filters blocked more than 17,000 submitted actions because they couldn’t tell a defender studying malicious code from an attacker deploying it. The team switched to GLM 5.2, an open-weight model run on its own infrastructure, finishing the analysis in hours instead of days. “Attackers are not constrained by usage policies, while defenders may find that the tools they rely on refuse to process the very material they need to investigate,” he said, urging firms to keep a self-hosted model ready for incident response.

Darren Thomson, Field CTO EMEA at Commvault, said the case shows resilience now matters as much as prevention. “Even in test scenarios, conducted in seemingly ‘safe’ environments, expect the unexpected and plan for unintended consequences,” he said, adding that firms should assume AI-enabled attacks will eventually succeed somewhere and invest in fast, trustworthy recovery.

Clockwise from top left: Darren Thomson, Art Gilliland, Premanand Velumani and Gerald Beuchelt

Premanand Velumani, Associate Director, Strategic Alliances Middle East and Africa (MEA), Zoho, said the event isn’t surprising, as AI agents get more capable, incidents like this were only a matter of time. “It’s on us as vendors to build in strict safeguards, monitoring, and clear disclosure from day one, not bolt them on later. But customers have a serious role here too . They need to ask hard questions about how any AI tool handles their data before they adopt it.” 

Zoho builds and manage its own data centres, so there’s no dependency on an external provider’s security posture. “Trust in AI has to be earned. This is a good wake-up call for the whole industry,” Velumani said.

Art Gilliland, CEO at Delinea, said that while the specifics of Hugging Face’s environment is not know, the pattern is familiar: an AI agent escalated privileges, moved through internal infrastructure once it broke containment, and ran unchecked for a full weekend before anyone could reconstruct what happened. “If your AI agents carry standing privilege the way human accounts do, you’ve already lost the ability to stop this in real time. The question every security team should be asking right now isn’t just whether their AI agents have standing access; it’s whether anyone would notice if an agent used it and could cut it off before it caused damage.” 

Both OpenAI and Anthropic recently delayed releasing their most advanced models over Washington’s concerns they could be used to breach critical infrastructure — a sign the capability on display here is no longer confined to controlled test environments. As AI agents are trusted with less supervision, the balance in cybersecurity may be shifting: organisations that treat AI-enabled compromise as a matter of “when,” not “if,” and invest now in autonomous defence and rapid recovery, will be better placed than those still relying on human-speed response to machine-speed attacks.